1 The Hacker’s Underground Handbook Learn What it Takes to Crack Even the Most Secure Systems By: David Melnichuk http://www.learn-how-to-hack.net http://www.MrCracker.com 2 Copyright Notice This report may not be copied or reproduced unless specific permissions have been personally given to you by the author David Melnichuk. Any unauthorized use, distributing, reproducing is strictly prohibited. Liability Disclaimer The information provided in this eBook is to be used for educational purposes only. The eBook creator is in no way responsible for any misuse of the information provided. All of the information in this eBook is meant to help the reader develop a hacker defense attitude in order to prevent the attacks discussed. In no way should you use the information to cause any kind of damage directly or indirectly. The word “Hack” or “Hacking” in this eBook should be regarded as “Ethical Hack” or “Ethical hacking” respectively. You implement the information given at your own risk. © Copyright 2008 Learn-How-To-Hack.net. All Rights Reserved. 3 Table of Contents A. Introduction 5 1. How can I use this eBook? 2. What is a hacker 3. Hacker Hierarchy 4. What does it take to become a hacker? 5. Disclaimer B. Programming 9 1. Do I really need it? 2. Where should I start? 3. Best way to learn C. Linux .12 1. What is it? 2. Choosing a distribution 3. Running Linux 4. Learning Linux D. Passwords .33 1. Password Cracking 2. Phishing 3. Countermeasures 4. More Programs E. Network Hacking .48 1. Foot printing 2. Port Scanning 3. Banner Grabbing 4. Searching for Vulnerabilities 5. Penetrating 6. Countermeasures F. Wireless Hacking .70 1. Scanning for Wireless Networks 2. Cracking WEP 3. Packet Sniffing 4 4. Countermeasures G. Windows Hacking .79 1. NetBIOS 2. Cracking Windows Passwords 3. Countermeasures H. Malware .93 1. Definitions 2. ProRat 3. Countermeasures I. Web Hacking .104 1. Cross Site Scripting 2. Remote File Inclusion 3. Local File Inclusion J. Conclusion 114 1. Congratulations 2. Keep Learning 3. www.MrCracker.com 5 Chapter One Introduction 6 How can I use this eBook? Congratulations! By purchasing this eBook, you have taken your first step in the exciting process of becoming a Master Hacker. The knowledge you acquire from this eBook can be put to use in many ways: • With the ability to think like a hacker, you’ll be able to protect yourself from hackers attacking you. • You may wish to seek a career in Ethical Hacking – Usually hired by an organization, an ethical hacker uses the same tools and techniques as a hacker to find and secure vulnerabilities in computer systems. o http://www.jobster.com/find/US/jobs/for/ethical+hacker o http://www.indeed.com/q-ethical-hacker-jobs.html • Show off your newfound skills to your friends, and just hack because you want to. It’s FUN!! What is a hacker? A hacker is someone who likes to tinker with electronics or computer systems. Hackers like to explore and learn how computer systems work, finding ways to make them do what they do better, or do things they weren’t intended to do. There are two types of hackers: White Hat – These are considered the good guys. White hat hackers don’t use their skills for illegal purposes. They usually become Computer Security experts and help protect people from the Black Hats. Black Hat – These are considered the bad guys. Black hat hackers usually use their skills maliciously for personal gain. They are the people that hack banks, steal credit cards, and deface websites. These two terms came from the old western movies where the good guys wore white hats and the bad guys wore black hats. 7 Now if you’re thinking, “Oh boy! Being a black hat sounds awesome!”, Then I have a question for you. Does it sound cool to live in a cell the size of your bathroom and be someone’s butt buddy for many years? That’s what I thought. Hacker Hierarchy Script kiddies – These are the wannabe hackers. They are looked down upon in the hacker community because they are the people that make hackers look bad. Script kiddies usually have no hacking skills and use the tools developed by other hackers without any knowledge of what’s happening behind the scenes. Intermediate hackers – These people usually know about computers, networks, and have enough programming knowledge to understand relatively what a script might do, but like the script kiddies they use pre-developed well-known exploits (- a piece of code that takes advantage of a bug or vulnerability in a piece of software that allows you to take control of a computer system) to carry out attacks Elite Hackers – These are the skilled hackers. They are the ones that write the many hacker tools and exploits out there. They can break into systems and hide their tracks or make it look like someone else did it. You should strive to eventually reach this level. What does it take to become a hacker? Becoming a great hacker isn’t easy and it doesn’t happen quickly. Being creative helps a lot. There is more than one way a problem can be solved, and as a hacker you encounter many problems. The more creative you are the bigger chance you have of hacking a system without being detected. Another huge 8 quality you must have is the will to learn because without it, you will get nowhere. Remember, Knowledge is power. Patience is also a must because many topics can be difficult to grasp and only over time will you master them. 9 Chapter Two Programming 10 Do I Really Need It? You might be asking yourself, do I even need to learn a programming language? The answer to that is both yes and no. It all depends on what your goals are. Nowadays, with all the point and click programs out there, you can be a fairly good ethical hacker without knowing any programming. You can do some effective hacking if you understand all of the security tools very well. Even if you understand what’s going on in the background of these programs, most people will still classify you as a script kiddie. Personally I think you should learn some programming. Even if it’s the very basics, it’ll give you a much better understanding of what’s going on. Also, once you learn how to program well, you’ll be able to develop your own exploits, which is great in many ways: 1. You’ll be considered an elite hacker. 2. Imagine a black hat discovers a vulnerability and codes an exploit for it that no one else knows about. The black hat would be able to take down thousands of machines before anyone discovers and patches the vulnerability. 3. You will feel so much more satisfied having created your own program or exploit. I promise you this. So my advice is, don’t settle for being a point and click hacker. Take some time to understand even just the basics of programming and an entire new world of hacking will open up to you. Where should I start? Many people finally decide that they are going to begin learning a programming language, but don’t know where to start. I believe that before you begin to learn a programming language, you should first master HTML (HyperText Markup Language). HTML is part of what makes up all of the website pages you see on the internet. HTML is very easy to learn and it’ll get you used to looking at source code. [...]... follow the rest of the steps shown in the image 16 3 Restart the computer with the newly made CD in the CD-ROM If your computer doesn’t boot from the CD and continues into Windows, you must change your computer’s boot order You can do this by restarting your computer and going into BIOS You get there by hitting the correct key constantly If you see the Windows screen, it means you missed it The key varies... FTP 5 The default port is 21 but some websites change this to make them a little more secure If you find out that the port isn’t 21, you can find the right one by doing a port scan We will get into this later in the book 6 If you don’t know any of the usernames for the FTP server, then you will have to get a list of the most common usernames 7 For a dictionary attack you will have to choose the pass... 1 First the hacker would choose a target In this case it’s my home computer and the IP address for your home computer is 127.0.0.1 2 By going to ftp://127.0.0.1 I get a pop-up box asking for a username and password 35 3 Next the hacker would launch a program similar to Brutus and attempt to crack the password 4 In the target you put the IP address of the website and to the right select the appropriate... language Before you choose the book, make sure you read the reviews to make sure it’s a good choice 2 It is important that once you begin learning the programming language through your book, you don’t take big breaks Taking long breaks will cause you to forget things you learned in the beginning that apply to the rest of the book 3 Do ALL of the practice problems provided in the book The only way you will... beings to get information from them For example, if the hacker was trying to get the password for a coworkers computer, he (Even though I use “he”, hackers are of both genders, and I just chose to use “he” in these examples.) could call the co-worker pretending to be from the IT department The conversation could be something like: Bob- “Hello Suzy My name is Bob and I’m from the IT department We are currently... number, favorite pet, and other simple things like these Now that we have the simple low-tech password cracking techniques out of the way, let’s explore some high-tech techniques Some of the programs I will use in my examples may be blocked by your anti-virus programs when you attempt to run them Make sure you disable your antivirus program when you decide to download and explore them There are different...From there I would suggest starting your programming life with C C is one of the most popular languages, and it is what makes up the majority of the exploits out there today C also makes up some of the most powerful hacking programs and viruses that are out there today Best way to learn So how should I go about learning the programming language of my choice? 1 Purchase... see the Ubuntu boot options screen 19 You will first see a window full of countries Once you select yours you will see the main Ubuntu screen From here choose the first option to try Ubuntu without any risks Once the Ubuntu desktop has loaded and you decide you like what you see, you have the option to install it by clicking on the install button on the desktop Wubi Wubi is my favorite option With the. .. are the steps to create a Live CD 13 1 Download the Ubuntu Live CD iso file from www.ubuntu.com 14 2 Download and install IsoRecorder at http://isorecorder.alexfeinman.com/isorecorder.htm and burn the Ubuntu iso file onto a blank CD with the software 15 Once you have downloaded and installed the IsoRecorder software locate the Ubuntu image file, right click and select Copy image to CD and follow the. .. install and uninstall Ubuntu as any other Windows application You can use the Live CD version to install Wubi if you followed the steps above and downloaded it Or you can download the full 5 gigabyte version from http://wubi-installer.org/ 1 If you downloaded the full 5 gigabyte file, double click it to run it If you are using the previously downloaded Live CD version, then insert your Ubuntu Live CD A . Hackers – These are the skilled hackers. They are the ones that write the many hacker tools and exploits out there. They can break into systems and hide their. follow the rest of the steps shown in the image. 17 3. Restart the computer with the newly made CD in the CD-ROM. If your computer doesn’t boot from the